What is the CVSS score of EUVD-2026-55689?

EUVD-2026-55689 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dokploy are affected by EUVD-2026-55689?

Dokploy, a self-hosted application deployment platform, contains a critical command injection vulnerability in its Git deployment feature that allows authenticated users with deployment permissions…. A patch is available.

How to fix or mitigate EUVD-2026-55689?

Within 24 hours: audit all users with service-deployment permissions in Dokploy and revoke or disable SSH keys from user accounts, then monitor deployment logs for suspicious activity. Within 7 days: restrict service-deployment permissions to only essential administrators, disable custom Git deployments if not actively required, and implement network segmentation to limit Dokploy instance connectivity to trusted Git repositories only. Within 30 days: establish a formal deployment approval workflow requiring security review of all Git deployment configurations, monitor for Dokploy patch release of version 0.29.13 or later, and conduct a post-incident review of deployment history to identify any unauthorized command execution.

Dokploy EUVD-2026-55689

| CVE-2026-72740 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable via the deploy UI/API with low complexity, but requires a deployment-permitted member account (PR:L); host command execution escapes the app scope (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 18:34 vuln.today

Analysis Generated

Aug 10, 2026 - 18:34 vuln.today

CVE Published

Aug 10, 2026 - 17:55 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.

AnalysisAI

OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment permission and an attached SSH key run arbitrary commands on the Dokploy host. The flaw lives in the custom-Git deployment path, where the host portion of a user-supplied customGitUrl is interpolated unquoted into an ssh-keyscan shell command that executes during deployment. No public exploit is identified at time of analysis, but the fix commit is public and the trigger is trivial for anyone with deploy rights.

Technical ContextAI

Dokploy builds shell command strings in packages/server/src/utils/providers/git.ts and passes them to /bin/sh -c (locally via execAsync or remotely via execAsyncRemote). The custom-Git provider takes a user-controlled customGitUrl, parses it with sanitizeRepoPathSSH, and passes the extracted domain to addHostToKnownHostsCommand, which built ssh-keyscan -p ${port} ${domain} >> ${knownHostsPath} || true; with no shell quoting. This is a textbook CWE-78 (OS Command Injection) via unsanitized interpolation of attacker data into a shell context; the domain field is the injection point, so shell metacharacters ($(...), ;, backticks, |) in the hostname break out of the ssh-keyscan argument and execute as separate commands. The vendor's fix introduces a shellWord() helper (wrapping shell-quote's quote()) applied across all Git providers - bitbucket, gitea, github, gitlab and the generic git path - and casts port with Number(), indicating the branch name, clone URL, output path and other fields shared the same unsafe pattern. Affected CPE: cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* (all versions prior to 0.29.13).

RemediationAI

Vendor-released patch: 0.29.13 - upgrade to Dokploy v0.29.13 or later (https://github.com/Dokploy/dokploy/releases/tag/v0.29.13), which routes user-controlled Git fields through the new shellWord() shell-quoting helper. Until you can upgrade, reduce the attack surface by tightly restricting who holds service-deployment permission and the ability to attach SSH keys, since exploitation depends on those grants; treat every member with deploy rights as effectively having host shell access. As a targeted interim control, avoid or disable use of the custom Git URL deployment path (the customGitUrl/generic-git provider) and prefer the managed GitHub/GitLab app integrations, and audit existing services for suspicious customGitUrl domain values containing shell metacharacters - the trade-off is loss of arbitrary self-hosted Git source support until patched. Review the GHSA advisory (https://github.com/Dokploy/dokploy/security/advisories/GHSA-6693-xv3f-69px) for authoritative guidance.